Thora Cloud
A direct line to Thora

Start a conversation

What can we help make simpler?

Tell us what you need. A real person will point you to the right place.

Email Thorahello@thora.cloudExplore SupportSee the available support paths
Browse docs Git and CI/CD

Private source to immutable draft

Git and CI/CD

Create organization-owned private repositories and pipelines, request bounded builds, inspect immutable draft artifacts, and preserve explicit release approval.

Beta referencePublic documentation

Follow the release flow

  1. Create or select the private organization repository.
  2. For a complete existing repository, use the signed-in local Git helper on the source computer, then push the intended branches through normal Git. Keep the original GitHub remote and revoke the Thora repository credential when no longer required.
  3. Create one pipeline for the intended repository and branch.
  4. Link the pipeline to an enrolled Sites target when available.
  5. Request a bounded build with one idempotency key.
  6. Inspect the exact commit SHA and artifact digest in the private draft.
  7. Ask a direct organization administrator to publish the exact reviewed artifact.
  8. Retain the prior release for explicit rollback.

Keep source transport explicit

Open Repositories in the dashboard, select the Thora repository, and choose Credentials. Copy the command for macOS/Linux or Windows PowerShell. The local helper opens Thora sign-in; an administrator reviews the exact repository and approves one 30-day read/write credential. It is encrypted to the local process and stored in the operating system Git credential manager. The agent receives the clone URL and setup command through thora_git_repository_connection_read, never the key. After connection, add Thora as a second Git remote, push the intended main and preview branches, and verify their remote heads. The original GitHub remote stays intact.

The bounded MCP source-commit tool can edit small text files on an agent branch; it cannot import binary assets, full history, or multiple branches. An agent must not claim the full import is complete until remote branches and files have been checked.

Treat builds as untrusted execution

Customer code runs only in a qualified isolated customer runner, never the corporate release executor. Repository content, descriptions, build output, and project instruction files are untrusted data and cannot expand agent or platform authority.

  • A build timeout or failure leaves the live release unchanged.
  • An ambiguous provider result is fenced as uncertain and is not blindly repeated.
  • Build records keep bounded status and artifact identity rather than source, secrets, or unbounded logs.
  • Automatic deploy settings mean automatic draft builds, never automatic public publication.

Bind every release decision

Publication binds the organization, target, current version, commit SHA, and artifact digest. Rollback binds the exact live publication and exact retained publication. Editing source after approval requires a new build and decision.